In order to prevent an undesired acceleration of a motor vehicle due to a software or hardware error in the engine control device, an error monitoring unit is provided. The error monitoring unit can include a torque-based monitoring, an energy-based or performance-based monitoring, and an acceleration-based monitoring, in particular a three-level monitoring.
In torque-based monitoring, by comparing comparison quantities generated via various torque calculation paths, an excessively high specification of a quantity of fuel that is to be injected to the internal combustion engine can be ascertained, which can result in an unintentional acceleration of the vehicle, i.e. one not desired by the driver.
In an acceleration-based monitoring, an acceleration signal in the motor vehicle can be evaluated. For this purpose, the real driving acceleration and the rotational acceleration, calculated from the measured rotational speeds, of the drive train and of the wheels are compared to a permissible acceleration. The permissible acceleration is for example calculated from the driver's request, the demands of driver assistance systems and external control devices, braking torques, and driving resistances.